Legal · Data Protection

Privacy Policy

Last updated: 20 April 2026 · Effective date: 20 April 2026

1. Data Controller

The data controller responsible for your personal data is:

• Company: EBA Banyo Ürünleri Sanayi ve Ticaret Ltd. Şti.
• Brand: VALA
• Address: Ataşehir, Istanbul, Türkiye
• Email: info@vala.com.tr
• WhatsApp: +90 540 440 2200

2. What Data We Collect

2.1 Data You Provide Directly

• Catalogue download form: name, email address, country
• Sample request form: name, email, company, delivery address, phone, product preferences
• Inquiry form (dealer / project): name, company, email, phone, country, project details
• Contact form: name, email, message content
• Newsletter subscription: email address
• WhatsApp communication: phone number, message content

2.2 Data Collected Automatically

• IP address, browser type, device type, operating system
• Pages visited, time spent, referral source, language preference
• Cookie and similar tracking data (see our Cookie Policy)
• Approximate geographic location (derived from IP address)

3. How We Use Your Data

We process your personal data for the following purposes:

• Service delivery: responding to inquiries, sending catalogues, dispatching samples
• Commercial communication: distributor agreements, project quotations, OEM programs
• Marketing (with consent only): newsletters, product updates, trade event invitations
• Analytics: improving website performance, understanding visitor behaviour
• Legal compliance: tax records, export documentation, regulatory obligations
• Security: fraud prevention, anti-spam, site integrity

4. Legal Basis for Processing

Under GDPR and KVKK, we process your data on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): newsletter subscriptions, marketing communications, non-essential cookies
• Contract performance (Art. 6(1)(b) GDPR): processing trade inquiries, fulfilling orders, sample shipments
• Legitimate interest (Art. 6(1)(f) GDPR): B2B outreach to industry professionals, fraud prevention, site analytics
• Legal obligation (Art. 6(1)(c) GDPR): tax records, customs documentation, regulatory compliance

5. Who We Share Data With

We do not sell personal data. We may share data with the following categories of recipients, strictly as necessary:

• Service providers: hosting (Vercel, Cloudflare), email delivery, analytics, CRM platforms
• Logistics partners: for sample shipping and order delivery
• Authorized distributors: when you specifically request connection with a local VALA partner
• Legal / regulatory authorities: when required by law, court order, or regulatory request
• Professional advisors: auditors, lawyers, accountants, under confidentiality obligations

6. International Data Transfers

VALA operates from Türkiye and works with partners in 42+ countries. Personal data may be transferred outside your country of residence. For transfers outside the EEA or to countries without an adequacy decision, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. How Long We Keep Your Data

• Contact inquiries: 24 months from last interaction
• Trade / B2B relationships: duration of business relationship + 10 years (Turkish Commercial Code)
• Newsletter subscribers: until you unsubscribe
• Analytics data: 26 months (anonymized after 14 months)
• Tax / financial records: 10 years (Turkish law requirement)

8. Your Rights

Under GDPR and KVKK, you have the following rights regarding your personal data:

• Right of access: obtain a copy of the data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: oppose processing based on legitimate interest or for marketing
• Right to withdraw consent: at any time, where processing is based on consent
• Right to lodge a complaint: with your local data protection authority

To exercise any of these rights, email us at info@vala.com.trwith the subject line "Data Subject Request". We will respond within 30 days.

9. Data Security

We apply appropriate technical and organizational measures to protect your data, including HTTPS encryption, access controls, regular security reviews, and staff training. No system is 100% secure — in the unlikely event of a personal data breach affecting your rights, we will notify the relevant authority within 72 hours and inform you directly if required by law.

10. Children's Data

VALA's website is intended for trade professionals and adult consumers. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us for deletion.

11. Cookies

We use cookies and similar technologies. Details, categories, and opt-out controls are described in our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy periodically. The "Last updated" date at the top indicates the version. Material changes will be communicated via email (for registered contacts) or a prominent notice on the website.

13. Contact

For any privacy-related question or to exercise your rights:

• Email: info@vala.com.tr
• Subject line: "Privacy Inquiry" or "Data Subject Request"
• Postal: EBA Banyo Ürünleri Sanayi ve Ticaret Ltd. Şti., Ataşehir, Istanbul, Türkiye